CN103793199B - A kind of fast rsa password coprocessor supporting dual domain - Google Patents

Abstract

A fast RSA cryptographic coprocessor supporting dual domains, including: a domain control register for receiving externally input control signals; a control register for receiving externally input control signals; a RAM storage unit for storing externally input Operands and operation results; binary expansion domain, connected to the output terminal of the domain control register, receiving the control signal of the domain control register; prime number domain, connected to the output terminal of the domain control register, receiving the control signal of the domain control register; dual-domain modular multiplication The unit is respectively connected to the control register, the RAM storage unit, the binary expansion domain and the prime number domain, and is used to calculate the external operand stored in the RAM storage unit according to the control signal of the domain control register, and store the calculation result back to the RAM storage unit Inside. The invention effectively avoids a large amount of redundant data write-back process, improves the encryption and decryption performance of RSA, realizes the function of switching between different finite fields, increases the area by less than 20%, and has a very obvious effect.

Description

A Fast RSA Cryptographic Coprocessor Supporting Dual Domains

technical field

The invention relates to an RSA cryptographic coprocessor. In particular, it concerns a fast RSA cryptographic coprocessor that supports dual domains.

Background technique

With the development of computer network and information technology, information security is playing an increasingly important role in various fields, among which cryptography has become the core of information security technology. RSA is currently recognized as the most mature and perfect public key cryptosystem in theory and practical application. It is based on the difficulty of factoring large integers to ensure the security of the algorithm. At present, most encryption and digital signatures using public key cryptography use the RSA algorithm.

The large number modular exponentiation operation is the core operation of the RSA algorithm. It is composed of a series of large number modular multiplication operations. The number of digits of large numbers needs to be from hundreds to thousands of bits. Therefore, the amount of calculation is very large, and the modular multiplication operation is a constraint. The bottleneck of its computing speed, solving the speed problem of modular multiplication is the most fundamental way to improve its computing efficiency. Public key cryptography is an algorithm based on finite fields. Prime number fields and binary extended fields are the most commonly used finite fields in RSA. In order to realize the fast and configurable RSA algorithm, three modules of operation, storage and control and three modules of the system are designed. Interconnection between modules.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method that utilizes the cascading between functional units to effectively improve the encryption and decryption performance of RSA, realize the function of switching between different finite fields, and fully reuse hardware resources. A fast RSA cryptographic coprocessor with dual domain support.

The technical solution adopted in the present invention is: a fast RSA cryptographic coprocessor that supports dual domains, comprising:

The domain control register is used to receive external input control signals;

The control register is used to receive an externally input control signal;

RAM storage unit, used to store external input operands and operation results;

Binary domain expansion, connecting the output terminal of the domain control register, receiving the control signal of the domain control register;

The prime number field is connected to the output end of the field control register and receives the control signal of the field control register;

The dual-field modular multiplication unit is connected to the control register, RAM storage unit, binary expansion field and prime number field respectively, and is used to calculate the external operand stored in the RAM storage unit according to the control signal of the domain control register, and store the calculation result back to the RAM storage unit.

The RAM storage unit includes a first single-port RAM storage unit, a second single-port RAM storage unit and a third single-port RAM storage unit.

The dual-domain modular multiplication unit includes a state machine unit for simulating algorithm execution and a multiplication accumulator unit for unifying the modular multiplication operation into a+x*y+b by fusing two different finite-field algorithm structures .

The state machine unit includes the fourth multiplexer corresponding to receive the operand Xi output from the RAM storage unit, the seventh multiplexer of the operand Yi, the operand Xi, and the first multiplexer of Tj device, operand Ti, the third multiplexer of the exclusive OR gate of Nj, operand Zi, and is provided with the binary expansion domain output end that is respectively connected with described multiplication accumulator unit and stores the carry accumulation number of different time Ca memory and Cb memory, X memory, Y memory and Z memory for storing operands correspondingly connected to the output ends of the first multiplexer, the second multiplexer and the third multiplexer respectively, Wherein, the other input terminal of the OR gate receives the external Inv signal output terminal and connects the input terminal of the second multiplexer, and the first multiplexer, the second multiplexer and the third multiplexer The input end of the selector is also connected to the prime number field output end of the multiply-accumulator unit, the input end of the third multiplexer and the fourth multiplexer are also connected to the output end of the Ca memory, and the Cb The output terminals of the memory are respectively connected to the input terminals of the fourth multiplexer and the fifth multiplexer, and the output terminals of the X memory, the Y memory and the Z memory are connected to the fifth multiplexer and the sixth multiplexer respectively. selector and the input terminal of the seventh multiplexer, the other input terminal of the fifth multiplexer receives a digital 1, the fourth multiplexer, the fifth multiplexer, the sixth multiplexer The output ends of the road selector and the seventh multiplexer) constitute the state machine unit respectively, and the output ends of the multiplier-accumulator unit are connected.

The multiplier-accumulator unit receives the 64-bit binary addend a, addend b, multiplier X and multiplier Y from the input end of the RAM memory unit, and the output end outputs the prime number domain result c and the binary expansion domain respectively. The multiplier-accumulator of the result d is formed, and the multiplier-accumulator includes a first adder, a second adder, a third adder, and multiplies the received multiplier X and multiplier Y to output to the second adder respectively The double-field multiplier of the device, the input end of the first adder receives the binary addend a, the addend b respectively, the output end is respectively connected to the input end of the second adder and the third adder, the second adder The output end of the adder outputs a prime number field result c, and the output end of the third adder outputs a binary extension result d.

The double-field multiplier includes 64 half-add/full-add arrays connected in series in sequence, connected to the Wallace tree of the carry output of the 64 half-add/full-add arrays, respectively connected to the carry of the wzllace tree The carry propagation adder of the output terminal and the summation output terminal, wherein, the input terminal of the first half-add/full-add array of the 64 half-add/full-add arrays receives the multiplier X and the multiplier X of the RAM memory unit input Y, the output end of the last half-add/full-add array is respectively connected to the input end of the carry propagation adder and the second adder, and the output end of the carry propagation adder is connected to the third adder.

A fast RSA cryptographic coprocessor supporting dual domains of the present invention is based on predecessors' research on RSA modular exponentiation algorithm and Montgomery modular multiplication algorithm, combined with anti-side channel attack methods, and achieves a certain anti- Dedicated hardware cryptographic acceleration module for side channel attacks. Compared with general processors, application-specific integrated circuits, and FPGAs, the present invention has certain advantages in performance and safety. Compared with other RSA encryption hardware, the present invention adds the function of supporting dual domains, expands additional data paths, utilizes cascading between functional units, effectively avoids a large amount of redundant data write-back process, and improves RSA The excellent encryption and decryption performance realizes the function of switching between different finite fields, and fully reuses hardware resources. Compared with the cryptographic module that only supports single-field operations, the area is increased by less than 20%, and the effect is very obvious.

Description of drawings

Fig. 1 is the overall structure block diagram of the present invention;

Fig. 2 is a logical structural diagram of a dual-domain modular multiplication unit in the present invention;

Fig. 3 is the logical structural diagram of double-field multiplication accumulator among the present invention;

FIG. 4 is a schematic diagram of a dual-field multiplier in the present invention.

in the picture

1: Domain Control Register 2: Control Register

3: RAM storage unit 4: Dual domain modular multiplication unit

5: Binary extended field 6: Prime number field

detailed description

A fast RSA cryptographic coprocessor supporting dual domains of the present invention will be described in detail below in combination with embodiments and drawings.

A fast RSA cryptographic coprocessor supporting dual domains of the present invention adopts the Montgomery ladder algorithm in the modular exponentiation layer, and uses the FIOS algorithm in the modular multiplication layer. And through the comprehensive research and overall consideration of the modular multiplication and modular exponentiation algorithms, the hardware multiplexing of similar operations in the operation is carried out to reduce the area; the RAM in the architecture is specially connected to reduce the multiple handling of data in the process of modular exponentiation, saving Data transmission time; configurable design in the hardware implementation process, so that encryption and decryption support operations of different finite fields, so as to meet the needs of different users. At the same time, in order to support the two longest-used finite fields, an efficient 64bit *64bit dual domain multiplier. Secondly, through the research on side-channel attacks, from the initial algorithm research to the later hardware design process, anti-attack features are integrated throughout the design, so that the hardware design can effectively prevent power consumption attacks and fault attacks. Based on this Above, the design of the hardware modular multiplication module has been improved, thus preventing the hidden danger of power consumption leakage by the modular multiplication.

A fast RSA cryptographic coprocessor supporting dual fields of the present invention designs a special instruction set, and the user can dynamically adjust the finite field of operation by accessing the reserved interface and transmitting specific instructions. In order for the system to be easily integrated on the SoC (System on Chip), the present invention uses a single-port RAM interface signal to interconnect with the outside, and all main data and RAM of the system are 64bit wide.

As shown in Figure 1, a kind of fast RSA cryptographic coprocessor that supports dual domains of the present invention comprises: domain control register 1, is used to receive the control signal of external input; Control register 2, is used to receive the control signal of external input ; The RAM storage unit 3 is used to store the operand output operation result of the external input; the binary expansion domain 5 is connected to the output terminal of the domain control register 1, and receives the control signal of the domain control register 1; the prime number domain 6 is connected to the domain control The output terminal of the register 1 receives the control signal of the domain control register 1; the dual-domain modular multiplication unit 4 is respectively connected to the control register 2, the RAM storage unit 3, the binary expansion domain 5 and the prime number domain 6, and is used to control the register 1 according to the domain. The external operand stored in the RAM storage unit 3 is calculated by the control signal, and the calculation result is stored back in the RAM storage unit 3 . in,

The RAM storage unit 3 includes a first single-port RAM storage unit 31 , a second single-port RAM storage unit 32 and a third single-port RAM storage unit 33 . The dual-field modular multiplication unit 4 includes a state machine unit 41 for simulating algorithm execution and is used to unify the modular multiplication operation into a multiplication-accumulation of a+x*y+b by fusing two different finite-field algorithm structures device unit 42.

The state machine unit 41 of the present invention is designed using the Montgomery optimization algorithm FIOS (finely integrated operand scanning method). In the Montgomery optimization algorithm, the multipliers X, Y, and N are divided into r-bit numbers for operation, which is very beneficial to hardware implementation and can efficiently utilize registers. Moreover, all operations in the algorithm can be changed into one operation, which will help save hardware resources. The Montgomery optimization algorithm includes the modular multiplication algorithm under the prime field and the modular multiplication algorithm under the binary extended field. in,

1. Modular multiplication algorithm under prime field

The algorithm given in Table 1 is a high-radix Montgomery modular multiplication algorithm, which divides the operands of large numbers into small-bit words to participate in the operation. This patent designs a high-radix modular multiplier with a 64-bit bit width.

Table 1. FIOS algorithm of prime field

2. Modular multiplication algorithm under binary expansion field

Under the binary expansion domain, all data can be regarded as coefficients of polynomials, so their operations are also converted into arithmetic rules of polynomial coefficients, such as addition evolves into bitwise modulo two addition. Correspondingly, the same rule applies when adding partial products in multiplication. Table 2 shows the FIOS algorithms that support binary domain expansion.

Table 2. FIOS algorithm for binary domain expansion

3. Comparison of algorithms in different domains

The structure of the FIOS algorithm under the prime field and the binary field is basically the same, except for the difference between the basic addition and multiplication algorithms under the prime field and the binary field, there are two differences:

3.1. The number of digits of the modulus N under binary expansion usually exceeds the number of digits of the multiplier, and usually exceeds 2 bits. For example, the modulus of a 256-bit multiplication modulus is 258 bits, and the highest bit exceeded is 1, then the modulus N is compared There are 2 bits extra in the prime field (the value is 0x2), so the extra 2 bits need to be added to the calculation in the last iteration of the inner loop of the second layer of the algorithm (such as step 6 in Table 2).

3.2. The binary expansion operation will not generate a carry, so the subtraction in the last step will not be executed and can be removed directly.

4. The architecture of the dual-domain modular multiplier

By fusing two different finite field algorithm structures, the modular multiplication operation is unified as a+x*y+b, which helps the efficient and reusable operation resources, greatly saves hardware resources, and optimizes the hardware area. Figure 2 is a logical structure diagram of the dual-domain modular multiplier.

As shown in Figure 2, the state machine unit 41 of the present invention includes the fourth multiplexer 415 corresponding to the operand Xi output from the RAM storage unit 3, and the seventh multiplexer 418 of the operand Yi. , operand Xi, the first multiplexer 412 of Tj, operand Ti, the 3rd multiplexer 414 of the OR gate 413 of Nj, operand Zi, and be provided with and be respectively connected with described multiplication accumulator unit 42 The Ca memory 419 and the Cb memory 4120 of the binary expansion output and storing the carry accumulation numbers at different times are connected to the first multiplexer 412, the second multiplexer 413 and the third multiplexer respectively. X memory 421, Y memory 422 and Z memory 4123 for storing the operand at the output end of the device 414, wherein, the other input end of the OR gate 413 receives the external Inv signal output end and connects the second multiplexer 413 The input terminals of the first multiplexer 412, the second multiplexer 413 and the third multiplexer 414 are also respectively connected to the prime field output terminals of the multiply-accumulator unit 42, so The input ends of the third multiplexer 414 and the fourth multiplexer 415 are also connected to the output end of the Ca memory 419, and the output ends of the Cb memory 4120 are respectively connected to the fourth multiplexer 415 and the fifth multiplexer 415. The input terminal of the way selector 416, the output terminals of the X memory 421, the Y memory 4122 and the Z memory 4123 are respectively connected to the fifth multiplexer 416, the sixth multiplexer 417 and the seventh multiplexer 418 The other input terminal of the fifth multiplexer 416 receives a digital 1, the fourth multiplexer 415, the fifth multiplexer 416, the sixth multiplexer 417 and the fourth multiplexer 417 The output ends of the seven multiplexers 418 constitute the state machine unit 41 respectively, and the output ends of the multiplier-accumulator unit 42 are connected.

Reducing the number of times that division occurs in operations is an effective way to increase the speed of operations. In 1985, the modular multiplication algorithm proposed by Montgomery quickly replaced the classic modular reduction algorithm. The Montgomery algorithm does not rely on the comparison and division of long integers, but uses the remainder of the N module to represent the number. The operation is transformed into the division operation of the 2 exponent, which is a shift operation in the hardware implementation process. It is an algorithm that is very convenient for hardware implementation, so it is the most widely used.

The basic addition and multiplication under the prime field and the binary extended field are significantly different. The key is that the operation under the binary extended field is a polynomial operation, which has the characteristic that no carry will be generated compared with the traditional operation. The data under the binary expansion domain can be regarded as the coefficients of the corresponding polynomials, so the addition can be regarded as the addition of polynomials. According to the rule of adding items of the same order in polynomial operations, only numbers in the same position will be added without carry. The problem, and it is a modulo 2 addition, so that the binary extended field addition can be expressed as a bitwise XOR operation of data in binary form. Since the multiplication can be decomposed into the sum of partial products for operation, the result of the multiplication under the binary expansion field can be obtained by separating the result of the XOR operation in the process of adding the partial products, and then the multiplication result generated during the addition process The carry is added back, and the ordinary multiplication result is obtained. The structure of the 64-bit multiply-accumulator is shown in Figure 3, and the principle of the dual-field multiplier is shown in Figure 4.

As shown in FIG. 3 , the multiplier-accumulator unit 42 receives the binary addend a, addend b, multiplier X and multiplier Y of the 64-bit input from the memory unit 3 at the input end, and the output end outputs the prime number field respectively The multiplication accumulator of the result c and the binary expansion result d constitutes, and the multiplication accumulator includes a first adder 421, a second adder 422, a third adder 423 and the received multiplier X and the multiplier After Y is multiplied, output to the dual-field multiplier 424 of the second adder 422 respectively, the input ends of the first adder 421 respectively receive the binary addend a, the addend b, and the output ends are respectively connected to the second adder 422 and the input terminal of the third adder 423, the output terminal of the second adder 422 outputs the prime field result c, and the output terminal of the third adder 423 outputs the binary extension result d.

As shown in Fig. 4, described double-field multiplier 424 includes 64 half-add/full-add arrays 4241 connected in series in sequence, and connects the Wallace tree of the carry output end of described 64 half-add/full-add arrays 4241 4242, the carry-propagation adder 4243 connected to the carry output terminal and the sum output terminal of the Wallace tree 4242 respectively, wherein the first half-add/full-add array of the 64 half-add/full-add arrays 4241 The input terminal receives the multiplier X and the multiplier Y input by the memory unit 3, and the output terminal of the last half-add/full-add array is respectively connected to the input terminal of the carry propagation adder 4243 and the second adder 422 , the output end of the carry propagation adder 4243 is connected to the third adder 423 .

Claims (4)

1. A fast RSA cryptographic coprocessor supporting dual domains, comprising:

a domain control register (1) for receiving an externally input control signal;

the control register (2) is used for receiving an externally input control signal;

a RAM storage unit (3) for storing operands inputted from outside and operation results;

the binary domain expansion (5) is connected with the output end of the domain control register (1) and receives a control signal of the domain control register (1);

the prime number domain (6) is connected with the output end of the domain control register (1) and receives a control signal of the domain control register (1);

the double-domain modular multiplication unit (4) is respectively connected with the control register (2), the RAM storage unit (3), the binary extension domain (5) and the prime number domain (6), and is used for calculating external operands stored in the RAM storage unit (3) according to control signals of the domain control register (1) and storing the calculation results back into the RAM storage unit (3);

the double-domain modular multiplication unit (4) comprises a state machine unit (41) used for simulating algorithm execution and a multiplication accumulator unit (42) used for unifying modular multiplication operation into a + x y + b by fusing two algorithm structures of different finite domains; the state machine unit (41) comprises a fourth multiplexer (415) which respectively correspondingly receives an operand Xi output from the RAM storage unit (3), a seventh multiplexer (418) of the operand Yi, a first multiplexer (412) of the operands Xi, Tj, an exclusive-OR gate (413) of the operands Ti, Nj, a third multiplexer (414) of the operand Zi, a Ca memory (419) and a Cb memory (4120) which are respectively connected with the binary extension domain output end of the multiplier accumulator unit (42) and store carry accumulation numbers at different times, an X memory (421) which respectively correspondingly connects the output ends of the first multiplexer (412), the second multiplexer (413) and the third multiplexer (414) and is used for storing the operands, a Y memory (4122) and a Z memory (4123), wherein the other input end of the OR gate (413) receives an external Inv signal and the output end of the OR gate is connected with the output end of the second multiplexer (413) The input end of the first multiplexer (412), the input end of the second multiplexer (413) and the input end of the third multiplexer (414) are respectively connected with the prime field output end of the multiply accumulator unit (42), the input ends of the third multiplexer (414) and the fourth multiplexer (415) are respectively connected with the output end of a Ca memory (419), the output end of the Cb memory (4120) is respectively connected with the input ends of the fourth multiplexer (415) and the fifth multiplexer (416), the output ends of the X memory (421), the Y memory (4122) and the Z memory (4123) are respectively connected with the input ends of the fifth multiplexer (416), the sixth multiplexer (417) and the seventh multiplexer (418), the other input end of the fifth multiplexer (416) receives a number 1, and the fourth multiplexer (415), The output ends of the fifth multiplexer (416), the sixth multiplexer (417) and the seventh multiplexer (418) respectively form the output end of the state machine unit (41) and are connected with the multiplying and accumulating unit (42).

2. A fast RSA cryptographic coprocessor supporting dual domains as claimed in claim 1, characterized in that said RAM memory unit (3) comprises a first single-port RAM memory unit (31), a second single-port RAM memory unit (32) and a third single-port RAM memory unit (33).

3. The fast RSA cryptographic coprocessor supporting dual domains as claimed in claim 1, wherein the multiplier-accumulator unit (42) is composed of a multiplier-accumulator whose input end receives the 64-bit binary addend a, addend b, multiplier X and multiplier Y respectively input by the RAM memory unit (3), and whose output end outputs the prime domain result c and the binary extended domain result d respectively, the multiplier-accumulator includes a first adder (421), a second adder (422), a third adder (423), and a dual-domain multiplier (424) which multiplies the received multiplier X and multiplier Y and outputs the result to the second adder (422), the input end of the first adder (421) receives the binary addend a and addend b respectively, the output end connects the input ends of the second adder (422) and the third adder (423), the output end of the second adder (422) outputs the prime domain result c, an output of the third adder (423) outputs a binary extension result d.

4. A dual domain capable fast RSA cryptographic coprocessor as claimed in claim 1, the double-domain multiplier (424) is characterized by comprising 64 half-adding/full-adding arrays (4241) which are sequentially connected in series, wzllace (4242) connected with the carry output ends of the 64 half-adding/full-adding arrays (4241), and a carry propagation adder (4243) respectively connected with the carry output end and the summation output end of a Wallace tree (4242), wherein, the input end of the first half-adding/full-adding array of the 64 half-adding/full-adding arrays (4241) receives a multiplier X and a multiplier Y input by a RAM memory unit (3), the output end of the last half-adding/full-adding array is respectively connected with the input end of the carry propagation adder (4243) and the second adder (422), the output end of the carry propagation adder (4243) is connected with the third adder (423).